CVE-2026-66408 identifies a security weakness in ECOVACS ROBOTICS DEEBOT PRO M1 and DEEBOT PRO K1VAC where the root accounts are configured with weak passwords. This configuration flaw allows an attacker with physical access to the device to potentially retrieve the root password, compromising device security. The vulnerability has a CVSS 3.1 base score of 4.6, reflecting a medium severity level, with attack vector requiring physical access, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none.

An attacker with physical access to the affected devices can obtain the root account password due to weak credential configuration. This could lead to unauthorized access to the device at the highest privilege level, potentially exposing sensitive information or enabling further malicious actions on the device. There is no indication of remote exploitation or impact on integrity or availability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, physical security controls to prevent unauthorized access to the device are recommended.